5 ms·
Openbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.
by tedunangst 3y ago
Openbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.
- JohnFen 3y agoIf it's assuming that it can make an internet connection, why does it do that rather than NTP?
- toast0 3y agoNTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.
- anthk 3y agoYou can always use a gpsd(4) compatible USB dongle as the time source.
- JohnFen 3y agoOr run their own NTP server. That's what I do in my home network.
- toast0 3y agoSure, if you have such a dongle, and it has sufficient view of the sky. Adding a 'free' https based sanity check on top of NTP seems like a good balance of cost vs reward. gps (and friends) is a nice way to get access to a very accurate timesource, but it's not always worth the cost.
- labawi 3y agoGPS doesn't send full time. It wraps every 1024 weeks, or about 20 years, hence you need a (very) rough basis in case the system is over 20 years old.
- somat 3y agoIt is a sanity check to protect against malicious ntp actors. http://man.openbsd.org/ntpd.conf#CONSTRAINTS http://man.openbsd.org/ntpd.conf#CONSTRAINTS